Context-sensitive analysis of obfuscated x86 executables

A method for context-sensitive analysis of binaries that may have obfuscated procedure call and return operations is presented. Such binaries may use operators to directly manipulate stack instead of using native call and ret instructions to achieve equivalent behavior. Since definition of context-sensitivity and algorithms for context-sensitive analysis have thus far been based on the specific semantics associated to procedure call and return operations, classic interprocedural analyses cannot be used reliably for analyzing programs in which these operations cannot be discerned. A new notion of context-sensitivity is introduced that is based on the state of the stack at any instruction. While changes in 'calling'-context are associated with transfer of control, and hence can be reasoned in terms of paths in an interprocedural control flow graph (ICFG), the same is not true of changes in 'stack'-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of call-strings based methods for the context-sensitive analysis using stack-context. The method presented is used to create a context-sensitive version of Venable et al.'s algorithm for detecting obfuscated calls. Experimental results show that the context-sensitive version of the algorithm generates more precise results and is also computationally more efficient than its context-insensitive counterpart. Copyright © 2010 ACM.

Context-sensitive analysis without calling-context

Since Sharir and Pnueli, algorithms for context-sensitivity have been defined in terms of 'valid' paths in an interprocedural flow graph. The definition of valid paths requires atomic call and ret statements, and encapsulated procedures. Thus, the resulting algorithms are not directly applicable when behavior similar to call and ret instructions may be realized using non-atomic statements, or when procedures do not have rigid boundaries, such as with programs in low level languages like assembly or RTL. We present a framework for context-sensitive analysis that requires neither atomic call and ret instructions, nor encapsulated procedures. The framework presented decouples the transfer of control semantics and the context manipulation semantics of statements. A new definition of context-sensitivity, called stack contexts, is developed. A stack context, which is defined using trace semantics, is more general than Sharir and Pnueli's interprocedural path based calling-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of calling-context based algorithms using stack-context. The framework presented is suitable for deriving algorithms for analyzing binary programs, such as malware, that employ obfuscations with the deliberate intent of defeating automated analysis. The framework is used to create a context-sensitive version of Venable et al.'s algorithm for analyzing x86 binaries without requiring that a binary conforms to a standard compilation model for maintaining procedures, calls, and returns. Experimental results show that a context-sensitive analysis using stack-context performs just as well for programs where the use of Sharir and Pnueli's calling-context produces correct approximations. However, if those programs are transformed to use call obfuscations, a contextsensitive analysis using stack-context still provides the same, correct results and without any additional overhead. © Springer Science+Business Media, LLC 2011.

Context-sensitive analysis of x86 obfuscated executables

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

O desenvolvimento moral na educação infantil: contribuições da literatura infantil e dos jogos dramáticos e teatrais

Pós-graduação em Educação - FFC

Evolution of subpatent parasitaemia in Trypanosoma cruzi chronically infected mice with the help of a cyclophosphamide amplification transfer assay

Avaliamos o potencial do ensaio clássico de subinoculação, modificado pelo tratamento com ciclofosfamida dos animais receptores, na detecção de parasitemias ocultas em camundongos com in-fecção crônica pelo Trypanosoma cruzi. O ensaio, além de simples, mostrou ter uma alta sensibilidade; assim, utilizando-se parasitas da fase aguda, o tratamento com ciclofosfamida revelou parasitemias em 53,8% dos animais infectados com um tripanosoma da cepa y, e em 20% dos animais infectados com um tripanosoma da cepa CL. O tratamento com ciclofosfamida aumentou a sensibilidade do ensaio de subinoculação nas infecções pela cepa CL, e resultou em igual sensibilidade quando utilizada a cepa Y. Nos camundongos de fase crônica, obtidos a partir de diversos esquemas de imunoprofilaxia (BCG, soro de camundongo imune) ou quimioterapia, o ensaio revelou parasitemias ocultas em 99% dos animais. Auxiliados pelo método da subinoculação-ciclofosfamida estudamos no espaço de um ano a evolução das parasitemias ocultas em um grupo de camundongos infectados que sobreviveram à fase aguda pelo tratamento com Benzonidazol. O ensaio revelou parasitemias ocultas em 100% dos animais. Entretanto, padrões contínuos e discontinuos de positividade puderam ser detectados.

Legitimacy and context: Implications for public sector reform in developing countries

This article examines the interplay between legitimacy and context as key determinants of public sector reform outcomes. Despite the importance of variables Such as legitimacy of public institutions, levels of civic morality and socio-economic realities, reform strategies often fail to take such contextual factors into account. The article examines, first, relevant literature both conceptual and empirical, including data from the World Values Survey project. It is argued that developing countries have distinctive characteristics which require particular reform strategies. The data analysed shows that in Latin American countries, there is no clear Correlation between confidence in public institutions and civic morality. Other empirical studies show that unemployment has a negative impact on the level of civic morality, while inequality engenders corruption. This suggests that poorer and socio-economically stratified countries face greater reform challenges owing to the lack of legitimacy of public institutions. The article concludes that reforms should focus on areas of governance that impact on poverty. This will in turn help produce more stable outcomes. Copyright (C) 2008 John Wiley & Sons, Ltd.

Genetic Instability Persists in Non-Neoplastic Urothelial Cells from Patients with a History of Urothelial Cell Carcinoma

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)